xworm | 7df7abdaaabc41cc080678e71723d5a3ef855abe8c154b87e39664640c8be48c

General

Target

SolaraX.exe
Size

75KB
MD5

bb4297c0a1be56440bc497fb1c276a82
SHA1

71db449f4de9b90906866b830ebdabc12c518c20
SHA256

7df7abdaaabc41cc080678e71723d5a3ef855abe8c154b87e39664640c8be48c
SHA512

a534e7f9107f226d127e0bc8472bb6d35c1eccfd38096ac13f1fb6aef885e52358e6766a604c735a50b0d8f2bb8c9b9bdf1f3e0fa418ccaed5eadadc504deab2
SSDEEP

1536:2MuQthAcx9+rFQCb9Hi/bWPUtb/UVbV6foaOirUpPyUS:7L9+rh0/bWPBVUROirUw3

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:34930

minimum-ball.gl.at.ply.gg:34930

Attributes

Install_directory
%AppData%
install_file
SolaraX.exe

Signatures

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral1/memory/2092-1-0x0000000001170000-0x000000000118A000-memory.dmp	family_xworm
behavioral1/files/0x000a000000018710-35.dat	family_xworm
behavioral1/memory/2020-37-0x0000000001300000-0x000000000131A000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2772	powershell.exe
2648	powershell.exe
1968	powershell.exe
2668	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SolaraX.lnk	SolaraX.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SolaraX.lnk	SolaraX.exe

Executes dropped EXE 2 IoCs

pid	Process
2020	SolaraX.exe
1828	SolaraX.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SolaraX = "C:\\Users\\Admin\\AppData\\Roaming\\SolaraX.exe"	SolaraX.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2768	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1968	powershell.exe
2668	powershell.exe
2772	powershell.exe
2648	powershell.exe
2092	SolaraX.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2092	SolaraX.exe
Token: SeDebugPrivilege	1968	powershell.exe
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeDebugPrivilege	2092	SolaraX.exe
Token: SeDebugPrivilege	2020	SolaraX.exe
Token: SeDebugPrivilege	1828	SolaraX.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2092	SolaraX.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 1968	2092	SolaraX.exe	31
PID 2092 wrote to memory of 1968	2092	SolaraX.exe	31
PID 2092 wrote to memory of 1968	2092	SolaraX.exe	31
PID 2092 wrote to memory of 2668	2092	SolaraX.exe	33
PID 2092 wrote to memory of 2668	2092	SolaraX.exe	33
PID 2092 wrote to memory of 2668	2092	SolaraX.exe	33
PID 2092 wrote to memory of 2772	2092	SolaraX.exe	35
PID 2092 wrote to memory of 2772	2092	SolaraX.exe	35
PID 2092 wrote to memory of 2772	2092	SolaraX.exe	35
PID 2092 wrote to memory of 2648	2092	SolaraX.exe	37
PID 2092 wrote to memory of 2648	2092	SolaraX.exe	37
PID 2092 wrote to memory of 2648	2092	SolaraX.exe	37
PID 2092 wrote to memory of 2768	2092	SolaraX.exe	39
PID 2092 wrote to memory of 2768	2092	SolaraX.exe	39
PID 2092 wrote to memory of 2768	2092	SolaraX.exe	39
PID 1364 wrote to memory of 2020	1364	taskeng.exe	42
PID 1364 wrote to memory of 2020	1364	taskeng.exe	42
PID 1364 wrote to memory of 2020	1364	taskeng.exe	42
PID 1364 wrote to memory of 1828	1364	taskeng.exe	43
PID 1364 wrote to memory of 1828	1364	taskeng.exe	43
PID 1364 wrote to memory of 1828	1364	taskeng.exe	43

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SolaraX.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraX.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SolaraX.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SolaraX.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\SolaraX.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SolaraX.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2648
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "SolaraX" /tr "C:\Users\Admin\AppData\Roaming\SolaraX.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2768

C:\Windows\system32\taskeng.exe
taskeng.exe {922415E4-D0E3-4E02-9C8E-30B33871D779} S-1-5-21-2703099537-420551529-3771253338-1000:XECUDNCD\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Users\Admin\AppData\Roaming\SolaraX.exe
  C:\Users\Admin\AppData\Roaming\SolaraX.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2020
- C:\Users\Admin\AppData\Roaming\SolaraX.exe
  C:\Users\Admin\AppData\Roaming\SolaraX.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
7e1b7430e33e3a9e1e9ff0a6e1e954bd

SHA1
904d2dfbed590c9e03313a4797435fb28cd6c5ab

SHA256
508f1f064efa4dded5227b21febbaeb96605d13982d9ebf566dbd06a59b90068

SHA512
4491e57f6906b940554df626290b847596254940d482113b4b383eddf9dffbf9a65336f577c6ab8523b6cc403955bfb44d07f2378b5f146bcf53d38ed9160562

Download Submit
C:\Users\Admin\AppData\Roaming\SolaraX.exe

Filesize
75KB

MD5
bb4297c0a1be56440bc497fb1c276a82

SHA1
71db449f4de9b90906866b830ebdabc12c518c20

SHA256
7df7abdaaabc41cc080678e71723d5a3ef855abe8c154b87e39664640c8be48c

SHA512
a534e7f9107f226d127e0bc8472bb6d35c1eccfd38096ac13f1fb6aef885e52358e6766a604c735a50b0d8f2bb8c9b9bdf1f3e0fa418ccaed5eadadc504deab2

Download Submit
memory/1968-6-0x0000000002D50000-0x0000000002DD0000-memory.dmp

Filesize
512KB

Download
memory/1968-7-0x000000001B6B0000-0x000000001B992000-memory.dmp

Filesize
2.9MB

Download
memory/1968-8-0x0000000001F70000-0x0000000001F78000-memory.dmp

Filesize
32KB

Download
memory/2020-37-0x0000000001300000-0x000000000131A000-memory.dmp

Filesize
104KB

Download
memory/2092-31-0x000000001AE80000-0x000000001AF00000-memory.dmp

Filesize
512KB

Download
memory/2092-0-0x000007FEF6183000-0x000007FEF6184000-memory.dmp

Filesize
4KB

Download
memory/2092-32-0x000007FEF6183000-0x000007FEF6184000-memory.dmp

Filesize
4KB

Download
memory/2092-33-0x000000001AE80000-0x000000001AF00000-memory.dmp

Filesize
512KB

Download
memory/2092-1-0x0000000001170000-0x000000000118A000-memory.dmp

Filesize
104KB

Download
memory/2668-15-0x0000000002760000-0x0000000002768000-memory.dmp

Filesize
32KB

Download
memory/2668-14-0x000000001B760000-0x000000001BA42000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads